diff options
| author | andre <andre@FreeBSD.org> | 2007-06-10 21:07:21 +0000 |
|---|---|---|
| committer | andre <andre@FreeBSD.org> | 2007-06-10 21:07:21 +0000 |
| commit | 445024c7ff4986844b8675e79a722921503413dc (patch) | |
| tree | 832c8d213ff37a60527e819b7443e39c1ac7301e | |
| parent | 51abe2d2e3af98e0f70ed990ae603c09c5346348 (diff) | |
| download | FreeBSD-src-445024c7ff4986844b8675e79a722921503413dc.zip FreeBSD-src-445024c7ff4986844b8675e79a722921503413dc.tar.gz | |
Fix a case in tcp_do_segment() where tcp_update_sack_list() would
be called with an incorrect segment end value. tcp_reass() may
trim segments when they overlap with already existing ones in the
reassembly queue. Instead of saving the segment end value before
the call to tcp_reass() compute it on the fly based on the effective
segment length afterwards.
This bug was not really problematic as no information got lost and
the eventual SACK information computation was correct nontheless.
MFC after: 1 week
| -rw-r--r-- | sys/netinet/tcp_input.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c index 37162aa..82e36db 100644 --- a/sys/netinet/tcp_input.c +++ b/sys/netinet/tcp_input.c @@ -2232,7 +2232,6 @@ dodata: /* XXX */ if ((tlen || (thflags & TH_FIN)) && TCPS_HAVERCVDFIN(tp->t_state) == 0) { tcp_seq save_start = th->th_seq; - tcp_seq save_end = th->th_seq + tlen; m_adj(m, drop_hdrlen); /* delayed header drop */ /* * Insert segment which includes th into TCP reassembly queue @@ -2276,7 +2275,7 @@ dodata: /* XXX */ tp->t_flags |= TF_ACKNOW; } if (tlen > 0 && (tp->t_flags & TF_SACK_PERMIT)) - tcp_update_sack_list(tp, save_start, save_end); + tcp_update_sack_list(tp, save_start, save_start + tlen); #if 0 /* * Note the amount of data that peer has sent into |
